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From: | 






































Sent: “Thursdav. Julv 14-2046 9°32 AM 

To: 

Cec: 

Subject: : S- security findings and going "live" on -—SECRETINOFORN— 
Attachments: ACES POAMItemWorkSheet approved.xisx 


Classification: SECRET//NCFORH- 


Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 


Good Morning 


Seems there is quite a bit of misunderstanding around this asset. | received a call last week, as did | inquiring as to 
why they have not on-boarded with enterprise security services. To understand the findings, one needs to understand 
the configuration and architecture. Below is the definition from the SSP. The first paragraph is the |OC, which is 
authorized; and the second is the FOC, which | understand will be funded soon. 



































Responses to| _ questions are included below in red. Also, attached POAM that includes all] __{liens. 


Regards, 























13. 20146 8:33 DM 











T ACES=- security findings and going “live” on ----SEERET/ANOFORN— 
Classification: “SECRET /NOFORN— 
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Derived From: INCG dated 20120213 
Declassify On: 20411231 














Can you please dig into this and provide me an answer back soonest. 


V/r 




















From: 
Sent: Tuesday, July 12, 2016 5:16 PM 
To: 

Subject: FW: ACES-- security findings and going “live” on --= SECRET NOFERN— 


Classification: SECRET//ReEreRs— 



































Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 
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This is an example of one of the systems that | discussed with Martha last week when we talked about how we're doing 
assessments and ICD 503 implementation here at NRO. We’ll probably chat about this one again on Thursday. 





Can you and your team provide me with nitty gritty details of ACES? I’m assuming it aligns with the “Advanced 
Collaboration Enterprise Services” system ? 

















@ What is the current status of the system? 
® What does the heat map assessment look like? 
































Is there a tear sheet for the system? 
How in-denth was the assessment? Did thev use the RFI apes acd 
































e How did the documentation (§ indings broken out as; 


Planned Close 
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’'m not sure who provided Martha with the write-up below, and I’m not sure who provided the “ISSE Comments” 


{column L) in the attached spreadsheet. 


Thanks, 


























From: 
Sent: Tuesday, July 12. 705 AM 

To: 

Subject: FW: ACES-- security findings ---SEGREFYNEFERN— 


Classification: -@REREDWNeFroRN— 


Classified By: 
Derived From: INCG dated 20120213 
Deciassify On: 20411231 





























ACES was only givena 














Given these findings and the fact that they want to 


connect to and certain issues need to be addressed and rectified prior to being allowed on either network. 

















From their documentation: 























Therefore, it is imperative that systems be tightened as much as possible to ensure the security of the networks on 


which they will reside. 


Here is a list of the DAO findings that are the most troublesome: 








(b)(1) 
(b)(3) 
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From: 

Sent: ebruarv 24 2016 2:60 PAA 

To: 

Ce: 

Subject: RE: Missing UFC CODES —-SEGRET/SIFAGINGFGRAN— 


Classification: SECRET//ST/TR/7NOFORN— 








Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 25X1, 20661231 












































From: 








20146 7-A5 AM 








: Missing UFC CODES ----SPCRET/7SHTIG/NEFORN— 
Classification: SECREE/A‘sETKACEORN- 


Classified By: [| 
Derived From: INCG dated 20120213 
. Declassify On: 25X1, 20661231 


What's a UFC code? 
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From: | 
Sent: Friday, February 19, 2016 3:23 PM 

















Subject: Missing UFC CODES ----SECRET//SI/ TR NOFORN— 
Classification: -GBRERBEA(6=/2%/40FoRN— 


Classified By: —St/PR//REDSETE— 
Derived From: INCG dated 20120213 
Declassify On: 25X1, 20661231 


DAO Reps, 


The assets listed below have been approved through step 1 in Xacta but do not have a UFC code associated with one or 
many of the locations. This information is vital. | would appreciate your assistance in encouraging the program to add 
this information. 

















Tracking 
Number | Name atior 
b 
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ACES Architecture 


Overview 


A basic ACES system consists of five components: 

e One ACES Server. The ACES server is the central node in the system. It maps the 
physical location and dimensions of every screen in the system, and routes commands to 
and from those screens regarding the information they are displaying. 

e ACES Display Client software. Every screen in an ACES system, be it a desktop 
display, a tablet, or a single tile in a video wall, has its own client. (The client is software 
that runs on the device or on a small computer attached to the screen.) The client's job is 
to communicate with the ACES Server: 

o The Client tells the Server about the various windows it is currently dispiaying 

o The ACES Server tells a Client to change what its screen is displaying (eg, 
"move this window to the left’, or "resize this window"). The ACES Server 
receives these commands from the web server. 

e ACES Desktop Client. The desktop client performs the same role as the display client. 
displaying pixels at the request of the ACES Server. However, the desktop client also 
gives end users the ability to manipulate those pixels through a GUI. 

® ACES ingest. This is a special process that runs on ACES Video Ingest Workstations to 
provide a mechanism for ingesting and manipulating video feeds from various , 
sources. is a specialized version of the ACES Desktop Client that includes the abilitv to 
ingest video feeds from other sources. (b)(3) 























e One ACES Web Server. The web server gathers information about each Client--its 
location and the windows it is displaying--from the ACES Server, and (as mentioned 
above) sends commands to the Clients through the ACES Server. The ACES Web 
Server is a web based interface provided to manipulate geospatial coordinates of pixel 
data. , 


ACES Server 


The majority of ACES processing occurs on the ACES Server. The ACES Server runs as a single 
threaded process on a Linux machine under the name “ACES-server’. The ACES Server is 
coded in Python and runs within a Python 3.x environment. The ACES Server process brokers 
messages among all ACES Clients. The ACES Server currently subscribes to ports 5566 
(receiver) and 5567 (sender). We selected these ports to avoid conflicts with well-established 
ports such as those described in Service Port and Transport Registry and to avoid known 
malicious exploit ports described in this intrusion detection FAQ. 


ACES Web Server 


The ACES Web Server is the primary interface that ACES users use to interact with the system. 
The ACES Web Server content is also called the ACES Console. It presents a visual map of all of 
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the pixels registered with the ACES environment along with all of the content mapped to those 
pixels. The user may add, remove, move and/or resize content via the ACES Web Server. 

The ACES Web Server runs as a single threaded process on a Linux machine under the name 
“ACES-webserver’. The ACES Web Server is coded in Python and runs within a Python 3.x 
environment. The ACES Web Server presents information to users via a JavaScript-based web 
browser application. While configurable, the ACES Web Server currently listens for TCP requests ~ 
on port 8888. Port 8888 is traditionally used by web servers to serve test pages. ACES Web 

Server communicates with the ACES Server via ports 5567 (receiver) and port 5566 (sender). We 
selected these ports to avoid conflicts with well-established poris such as those described in 
Service Port and Transport Registry and to avoid known malicious exploit ports described in this 


intrusion detection FAQ. 


ACES Desktop Client 


The ACES Desktop Client is a process that runs on a user’s desktop machine to interact with the 
ACES environment. The ACES Desktop Client process runs as a single threaded process ona 
Linux machine under the name “ACES-desktop-client’. ACES Desktop Client runs under the 
Linux KDE Plasma Desktop environment. It is coded in Python and runs within a Python 3.x 
environment. The ACES Desktop Client communicates with the ACES Server via ports 5567 - 
(receiver) and port 5566 (sender). We selected these ports to avoid conflicts with well-established 
ports such as those described in Service Port and Transport Registry and to avoid known 
malicious exploit ports described in this intrusion detection FAQ. 





ACES Ingest 


The ACES Ingest process runs on specialized ACES Video Ingest Workstations. It allows for the 
ingest of video feeds from provided thick client desktops or other video sources. ACES Ingest 
runs under the Linux KDE Plasma Desktop environment. It is coded in Python and runs within a 
Python 3.x environment. The ACES Ingest communicates with the ACES Server via port 5568 
but can be configured to communicate on any port. We selected these ports to avoid conflicts 
with well-established ports such as those described in Service Port and Transport Registry and to 
avoid known malicious exploit ports described in this intrusion detection FAQ. 


ACES Display Client 


The ACES Display Client is a visually interactive component of the ACES environment. Unlike the 
ACES Desktop Client, the ACES Display Client only presents visual information and is not 
interactive like a desktop. It functions as a blank canvas that manipulates pixels for displaying 
ACES content. The ACES Desktop Client process runs as a single threaded process on a Linux 
machine under the name “ACES-display-client’. It is coded in Python and runs within a Python 
3.x environment. The ACES Display Client communicates with the ACES Server via ports 5567 
(receiver) ahd port 5566 (sender). We selected these ports to avoid conflicts with well-established 
ports such as those described in Service Port and Transport Registry and to avoid known 
malicious exploit ports described in this intrusion detection FAQ. 
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LOGINS: the default login is ACES/ACES. We have setup the environment so that the default user does not need to login 


- they are simply presented with a desktop without any login required. They can however lock there screen if they need to 
get up from there desk 


Privileged users have individual/unique accounts on the photon compute server. In order to login as a privileged user, the 
user must login to the photon compute server either at console or via ssh from an ACES connected machine (i.e. logins 
from outside of the ACES network are NOT permitted). The privileged user has a private PKI key that matches a public 
key on all of the ACES machines. Once a privileged user logs in with their individual login, they can ssh 
root@<aces_node> to access privileged commands throughout the ACES network. 














A functional diagram of the Blackmagic HDMI to SDI converter is below. 
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ACES 
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Advance Collaboration Enterprise Services (ACES) 
Certified Test Plan (CTP) 
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ACES Architecture 


Overview 


A basic ACES system consists of five components: 


One AGES Server. The ACES server is the central node in the system. It maps the 

physical location and dimensions of every screen in the system, and routes commands to and from those screens regarding the information 
they are displaying. 

ACES Display Client software. Every screen in an ACES system, be it a desktop display, a tablet, or a single tile in a video wall, has its own 


client. (The client is software that runs on the device or on a small computer attached to the screen.) The client's job is to communicate with 
the ACES Server: 


© The Client tells the Server about the various windows it is currently displaying 
o The ACES Server tells a Client to change what its screen is displaying (eg, “move this window to the feft", or "resize this window’). 
The ACES Server receives these commands from the web server. 
ACES Desktop Client. The desktop client performs the same role as the display client: displaying pixels at the request of the ACES Server. 
However, the desktop client also gives end users the ability to manipulate those pixels through a GUI. 
ACES Ingest. This is a special process that runs on ACES Video Ingest Workstations to provide a mechanism for ingesting and manipulating 
video feeds from various sources. is a specialized version of the ACES Desktop Client that includes the ability to ingest video feeds from 





other sources. | 











One ACES Web Server. The web server gathers information about each Client-its location and the windows it is displaying--from the ACES 


Server, and (as mentioned above) sends commands to the Clients through the ACES Server. The ACES Web Server is a web based 
interface provided to manipulate geospatial coordinates of pixel data. 
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ACES Server 


The majority of ACES processing occurs on the ACES Server. The ACES Server runs as a single threaded process on a Linux machine under the 
name “ACES-server”. The ACES Server is coded in Python and runs within a Python 3.x environment. The ACES Server process brokers messages 
among all ACES Clients. The ACES Server currently subscribes to ports 5566 (receiver) and 5567 (sender). We selected these ports to avoid conflicts 


with well-established ports such as those described in Service Port and Transport Registry and to avoid known malicious exploit ports described in this 
intrusion detection FAQ. 


ACES Web Server 


The ACES Web Server is the primary interface that ACES users use to interact with the system. The ACES Web Server content is also called the 


ACES Console. It presents a visual map of all of the pixels registered with the ACES environment along with all of the content mapped to those pixels. . 


The user may add, remove, move and/or resize content via the ACES Web Server. 

The ACES Web Server runs as a single threaded process on a Linux machine under the name “ACES-webserver’. The ACES Web Server is coded in 
Python and runs within a Python 3.x environment. The ACES Web Server presents information to users via a JavaScript-based web browser 
application. While configurable, the ACES Web Server currently listens for TCP requests on port 8888. Port 8888 is traditionally used by web servers 
to serve test pages. ACES Web Server communicates with the ACES Server via ports 5567 (receiver) and port 5566 (sender). We selected these 


ports to avoid conflicts with well-established ports such as those described in Service Port and Transport Registry and to avoid known malicious 
exploit ports described in this intrusion detection FAQ. 
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ACES Desktop Client 


The ACES Desktop Client is a process that runs on a user's desktop machine to interact with the ACES environment. The ACES Desktop Client 
process runs as a single threaded process on a Linux machine under the name “ACES-desktop-client’. ACES Desktop Client runs under the Linux 
KDE Plasma Desktop environment. it is coded in Python and runs within a Python 3.x environment. The ACES Desktop Client communicates with the 
ACES Server via ports 5567 (receiver) and port 5566 (sender). We selected these ports to avoid conflicts with well-established ports such as those 
described in Service Port and Transport Registry and to avoid known malicious exploit ports described in this intrusion detection FAQ. 


ACES Ingest 


The ACES Ingest process runs on specialized ACES Video Ingest Workstations. It allows for the ingest of video feeds from provided thick client 
desktops or other video sources. ACES Ingest runs under the Linux KDE Plasma Desktop environment. It is coded in Python and runs within a 
Python 3.x environment. The ACES Ingest communicates with the ACES Server via port 5568 but can be configured to communicate on any 


port. We selected these ports to avoid conflicts with well-established ports such as those described in Service Port and Transport Registry and to 
avoid known malicious exploit ports described in this intrusion detection FAQ. 
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ACES Display Client 


The ACES Display Client is a visually interactive component of the ACES environment. Unlike the ACES Desktop Client, the ACES Display Client only 
presents visual information and is not interactive like a desktop. It functions as a blank canvas that manipulates pixels for displaying ACES content. 
The ACES Desktop Client process runs as a single threaded process.on a Linux machine under the name “ACES-display-client’. It is coded in Python 


and runs within a Python 3.x environment. The ACES Display Client communicates with the ACES Server via ports 5567 (receiver) and port 5566 
sender). 

















Hardware 
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Separation of Roles 


Show different roles are present on the system. 


At the login screen, login as user “aces” 
with default password “aces” 


Start a terminal window (Start menu, type 
Terminal and enter) 

ssh <user>@photon.nro.aces-aoe.com 
ssh -i <private_key_file> 
root@photon.nro.aces-ace.com 


User enters private key password 
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Notes: 


e Privileged User access is only granted on photon.nro.aces-aoe.com. in other words, Privileged Users cannot login directly from 
a workstation. 


-e This provides us a single point of auditability for all root user access. 


Least Privileged Users 


Show that administrators only have necessary privileges. 


At the login screen, login as user “aces” with 
default password “aces” 





Start a terminal window (Start menu, type 
Terminal and enter) 


Is -al /root 
ssh <user>@photon.nro.aces-ace.com 


ssh root@ws1.nro.aces-aoe.com. Enter the ssh 
private key password associated with <user> 


Is -al /root 
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Audit Log | 


Show the Audit information generated by the operating system is collected in logs. 








Procedure 






Result 





At the login screen, login as user 
“aces” with default password “aces” 









Start a terminal window (Start menu, 
type Terminal and enter) 






Is -al Vvar/log 























Password Policy 


Strength of passwords 


There is only one non-privileged user in the ACES environment. That user is ‘aces’ and has a password of ‘aces’. 
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Each privileged user generates a public and private key pair for use within the NRO ACES environment. The public key is placed in the 
/home/aces/ ssh/authorized _keys file and the /root/ ssh/authorized_keys file. When a privileged user attempts to ssh into a Photon Linux 
machine, the privileged user’s private key is compared against the public key in the candidate authorized_keys file. Privileged users on 
photon have PKI keys installed on every Photon Linux machine in the ACES environment. 


Account Enforcement 


Lock out user after | failed login attempts. 
ACES does not implement this policy. 


Procedure 





Disabling Unnecessary Services 


Minimizing services operating to those utilized. 


Result 

















Procedure 









At the login screen, login as user 
“aces” with default password “aces” 






Start a terminal window (Start menu, 
type Terminal and enter) 


systemctl —sfate=active 
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Notes: ACES only enables necessary services. This test verifies the list of active services. 


Access Control 


Discretionary Access Control 


ee 









Patch Verification 


Patch level verification for the operating system. 


At the login screen, login as user 
“aces” with default password “aces” 






Result 













Start a terminal window (Start menu, 
type Terminal and enter) 
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Warning Banner 


Legal notification banner issued to user prior to system access. 














a 





Malicious Code/ Antivirus Protection 


Virus detection. 





















Video i 


Will complete after meeting with COMM & Cross Domain Solution (CDS) team 
A functional diagram of the Blackmagic HDMI to SDI converter is below. 
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lOC Functional Capabilities 


This section contains a list of the hi 


gh-level functional requirements for the initial operating capability (IOC) version of ACES deployed to 
the JCC Westfields facility. 


General ACES Capabilities. 














Video Ingest Workstation Capability 
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Explicitly out of scope for IOC 


The following items are explicitly out of scope for IOC. This list is not exhaustive. If a capability is not listed above as explicitly 
supported, then it will NOT be implemented in IOC. This list is here for guidance only. 
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IOC equipment list 


Below is the major hardware components of the initial operating capability for ACES JCC Westfields. Additional peripherals such as 








Key items NOT included below that will be provided by NRO: 
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z 


AC-2.3 - Account 
Management 


AC-6 and AC-6.5 - 
Least Privilege 


AC-7.a-b, 7.1- 
Unsuccessful Logon 


AU-2.a-d, 2.3, AU-3- 
3.2, AU-12.@-¢, 12.1-4 
~ Audit Events 


AU-10-10..5 - Non- 
repudiation 


Authentication 


AU-8, 8.1 - Time 
Stamps 


Public Key 
Enablement (PKE) 
{1A.5[2}.1} 


POAGM [Title Creation Weaknesses 
: Date 





UNCLASSIFIED 
Project Plan of Action Worksheet 
Project: Advanced Collaboration Enterprise Services 
06/30/2016 08:58:46 


CAT POC Resource (Scheduled |Comments 
Required Completion 
Nate 


ISSE Comments 











Page 1 of 2 
UNCLASSIFIED 
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UNCLASSIFIED 
Project Plan of Action Worksheet 
Project: Advanced Collaboration Enterprise Services 
06/30/2016 08:58:46 


Weaknesses 





(ISCP) {CP-2.a} 


Cantinuous Monitoring) 6/30/2016 
Report (CMP) {CA-7} 














Page 2 of 2 
UNCLASSIFIED 
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From: 

Sent: Tue : M 

To: 

Ce: 

Subject: FW: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services 


(ACES) _|-- UNCLASSIFIED/F@ve-— 


Classification: UNCLASSIFIED//Fretco— 























NLT Thursday, please process a| [week iATT extension for the ACES program. 


























From: 
Sent: Tuesday, September 27, 2016 12:40 PM 
To: 
Ce: 
Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) --- (b)(3) 
UNCLASSIFIED/AFEte— 





























Classification: UNCLASSIFIED//A®eve— 











Given that out, | don’t have a problem with extending their [ATT until we can coordinate a recommendation 
with OS&CI. 























From: | 
Sent: 27. 2016 12:34 PM 


Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) n= (b)(3) 
UNCLASSIFIED//FOU6- 














Classification: UNCLASSIFIED//Aretco— 








Any issues if | extend the IATT for! >? With out this week in | don’t want them to have 
to turn the system off, and back on again. It is disruptive to their operations. 


1 
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From: 
Sent: Tuesdav. Sentemher_?7_ 2016 11°46 AM 














Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) Coo 
UNCLASSIFIEDAFEve— 


Classification: UNCLASSIFIED/ +Peve— 


| agree — any approvals should be clear that the approval is for the currently instantiated version and connectivity 

"only. Any future changes/phases require additional review (and most certainly testing) prior to approval. Like CSCF, lets 
put a recommendation together and send it to Terry, a and Martha for comments before we tweak it and send it 
forward. 


From: 
H 27.2016 11:44 AM 


Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) -— 
UNCLASSIFIEDHFOUS- 























Classification: UNCLASSIFIED/ /reve— 


Absolutely! The ATO recommendation is ONLY for WF NROC at this point. They are working towards incorporating the 
POAM issues for Network Access, and we would address that capability when they can meet the requirements. 


Please chime in if you feel that | am misstated anything. 


V/r 
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From: 
Sent: Tuesdav. Sentember 27. 2016 11:39 AM 
































Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) rom 
UNCLASSIFIED/FOUO— 


Classification: UNCLASSIFIED/ +eue— 











One thing that stood out on this is their plans for the future. | believe the instance as it is here at WF only and as 
currently configured is an acceptable risk. As they move forward with their additional plans to add West and potentially 
engage externally we should have them come back for reassessment and incremental approvals as each is potentially a 
security relevant change. Is that factored into your recommendation? 

















From: 
_ Sent: Tuesdav. Sentember 277. 2016 11:75 AM 


























Subject: FW: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) 
UNCLASSIFIED//FOve- 


Classification: UNCLASSIFIED//;evo— 


Sirs, 

Any direction on how we should be proceeding with this? Their [ATT expires Friday, the VIAB is done with their analysis 
of this system, however they are comparing this code to the suspect TDN code of yesteryear. (the coding is in separate 
languages, so both and | are doubtful that they will draw any similarities between the two.) 














-If we withdraw the IATT they will be forced to turn the system back off. {reminder that the system is only at NROC WF 
today) 

-We can extend the IATT. (Much like an ATO since it is being used operationally, it is either on or off to support the 
NROC mission) 

-(my recommendation) We can reinstate the ATO, with their POAM in work, potentially adding the findings that VIAB 
presented. (This would need to be coordinated behind the scenes through OS&CI Director or Deputy Director) 





As | recall from the our discussions with Mr. Duncan, he believed that the | {which 
is what the original ATO covered) That being said, | would like someone above me to make the call, since they made the 
call to turn it off. 





Vir 
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From: 
Sent: Tuecdav Gentamhor 977 2916 19-26 AAA 

















Subject: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) -— 
UNCLASSIFIED 


Classification: UNCLASSIFIED 




















As you know our IATT is set to expire We have not yet received the final determination from Mr. Duncan on 
the ATO. I’m requesting a| day extension until the VIAB team can give the hot wash brief to Ms. Courtney whom will 
intern meet with Mr. Duncan. 

Regards, 



































Classification: UNCLASSIFIED/ /reveo—_ 
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From: 

Sent: Friday, July 15. 2016 9:28 AM 

To: 

Subject: RE: ACES-- security findings and going "live" on --- SECRETHNGFERN— 





Classification: Sr¢REt//NOFORN— 








Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 








Copy all__| appreciate your support and am standing by (if needed)... 


Best, 

















Ben 

Sent: ¥, July 15, 2016 9:08 AM 
To: 

Subject: RE: ACES-- security findings and going “live” on | --SEEREFHNOFERN— 


Classification: 6BCREP//ANCFORN— 

















Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 


Sir, 

Not sure that would help...let things play out a little more. Only thing I really know is the Ms Courtney (D/OSCI) has a 
concern, and has not been willing to share what it is outside those not part of CIA...she is questioning us about the 
testing that was done, when it was her folks that did the testing. My bosses are trying to work this. 


























Front: 
Sent: Fridav. July 15. 2016 AM 














Subject: RE: ACES-- security findings and going “live” on SEER STOR 
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Classification: SECRET/7NOFORN 
Classified By: 4 


Derived From: INCG dated 20120213 
Declassify On: 20411231 











More than happy to set-up a meeting early next week with those who have questions and answer them. I'd like it to be 
a comprehensive Q&A though...| do not want to have to keep educating people over and over again about ACES like 
we’ve been doing for over 18 months. 


Thank you. 


Best, 




















From: 
Sent: Wednesday, July 13, 2016 5:36 PM 


To: 
eee FW: ACES- security findings and going “live” on ~~ SECRET//NOFORN— 
Classification: GB&EREE/A/NOCFORN— 

















Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 





FYI. 
Please take no action, nut be aware someone isn’t a fan... 














From: 
Sent: Wednesday, July 13, 2016 7:50 AM 
To: 











Subject: FW: ACES- security findings and going "live" on +--“SRCRET//NOFERN— 
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Classification: SECRET/(‘ReOPORH— 


Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 


























Heads up. will be asking for more details on this system. 
From: | 

Sent: Tuesday, July 12. 2016 5:14 PM 

To: 








Subject: FW: ACES-- security findings and going “live” on| + --- SEEREF//NOFORN— 
Classification: GRGREDTNOFORH— 





Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 
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This is an example of one of the systems that | discussed with Martha last week when we talked about how we’re doing 
assessments and ICD 503 implementation here at NRO. We'll probably chat about this one again on Thursday. 





Can you and your team provide me with ni ritty details of ACES? I’m assuming it aligns with the “Advanced 
Collaboration Enterprise Services” system ‘aa 

What is the current status of the system? 

What does the heat map assessment look like? 

Is there a tear sheet for the system? 

How in-depth was the assessment? Did they use the REL methodology to assess? 

How did the documentation (SAR, RAR, etc) look? 


’'m not sure who provided Martha with the write-up below, and I’m not sure who provided the “ISSE Comments” 
(column L) in the attached spreadsheet. 


Thanks, 





From: Courtney Martha K NRO USA GOV 

Sent: Tuesday, July 12, 2016 mi AM 

To: 

Subject: FW: ACES-- security findings ---SEGREFANOFORN— 


Classification: SHCRET//NOTORN— 
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Derived From: INCG dated 20120213 
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From: 

Sent: Thursday. July 14. 2016 11:23 AM 

To: 

Cc: 

Subject: RE: ACES— security findings and going “live" on _-SECRETHNOFORN— 





Classification: “SECRET77NOFORN— 


Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 





thanks for a very good overview. 


























From: 

Sent: Thursday, July 14. 2016 9:32 AM 
To: 

Cea 

Su 7 RE: ACES-- security findings and going "live" on ---SECRETIINOFORIT 


Classification: SECRETANCFORN 

















Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 
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Good Morning 











Seems there is quite a bit of misunderstanding around this asset. | received a call last week, as did Sonny, inquiring as to 
why they have not on-boarded with enterprise security services. To understand the findings, one needs to understand 
the configuration and architecture. Below is the definition from the SSP. The first paragraph is the 1OC, which is 
authorized; and the second is the FOC, which | understand will be funded soon. 
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Responses to. _ questions are included below in red. Also, attached POAM that includes all| _ liens. 





Regards, 




















From: 
Sent: Wednesday, July 13, 2016 5:33 PM 
To: 
Ce: 
Subject: FW: ACES-- security findings and going "live" on p---SECRET//NOFPORN 


Classification: -SECREE//ANCFORN 
































Classified By: | 
Derived From: INCG dated 20120213 
Declassify On: 20411231 




















Can you please dig into this and provide me an answer back soonest. 


V/r 


























From: 
Sent: Tuesday, July 12, 2016 5:16 PM 
To; 

Su : FW: ACES-- security findings and going “live” on ~~ -SECRET//NGFORN— 


Classification: -SHCRET//NOFORN— 

















Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 














This is an example of one of the systems that | discussed with Martha last week when we talked about how we’re doing 
assessments and ICD 503 implementation here at NRO. We’ll probably chat about this one again on Thursday. 
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Can you and your team provide me with nitty aa tak of ACES? 

















® What is the current status of the system? 
e Whatd eat map assessment look like? 


























¢ ls there a tear sheet for the system? 


® How in-depth w ? Did they use the RFI acca tea 
































® How did the documentation (SAR, RAR, etc) look? 





























I’m not sure who provided Martha with the write-up below, and I’m not sure who provided the “ISSE Comments” 
(column L) in the attached spreadsheet. 


Thanks, 














From: Courtney Martha K NRO USA GOV 
Sent: Tuesday, July 12, 2016 8:05 AM 











To: 
Subject: FW: ACES-- security findings ---SEGREFYNOFORN 
Classification: SGREREE/ANeFERN— 











Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 20411231 











ACES was only givena | Given these findings and the fact that they want to 
connect to certain issues need to be addressed and rectified prior to being allowed on either network. 

















From their documentation: 
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Classification: SECRESNePERIT 
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To: | 

Ce: | 

Date: 14- July 2016 

Subject: Advanced Collaboration Enterprise Services (ACES) 


System Boundary: Initial Operation Capability (IOC) - Authorized 


(U//FOUOYACES consists primarily of a server and video switcher that allows analysts the ability 
to change the presentation view by manipulating pixel space on a monitor from multiple display 
sources from . ACES eliminates the need for multiple monitors to view 
multiple screens of data. The display sources ar 





























System Boundary: Future Operation Capability (FOC) Not Authorized initially includes: 


(uAFeve} ACES installation does reauire ; 


| All of the ACES systems are self- 























contained on the ACES subnet. 
Risk Analysis: 


(UAFOUS) In June 2016, a Risk Assessment was performed to evaluate the security controls of 
the asset as High, Low, Low impact levels for Confidentiality, Integrity and Availability 
respectively. Analysis of the Risk Assessment Report and negotiations with the program resulted 
in| |total liens as follows. 








DAO Rep Recommendation: 





(U#F6U6}Based on the agreed upon lien closure dates, recommend a| lyear ATO with POAM 
for ACES. During this, _ year period, the program needs to pursue an IATT to connect to 

to obtain enterprise security services to close many of the identified security weaknesses. 
Additionally, the program needs to begin immediately executing the Continuous Monitoring Plan 
to keep apprised, manage, and report the asset’s security controls proactively. 
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Subject: : Approved - ACES POAM --- UNCLASSIFIEDAFOUC- 
Attachments: 200233 ACES RAR 14JUL2016.docx 


Classification: UNCLASSIFIED//+feve- 


Hello Sir- 


Please note the Risk Assessment task was just approved by me, moving the asset to Program Acknowledgement. Also, 
given the visibility of this asset, | completed and loaded the attached RAR into Xacta. 


Thanks. 





From:| 
Sent: Tuesday, Ju 2016 3:07 PM 














Subject: FW: Approved - ACES POAM --- UNCLASSIFIED 


Classification: UNCLASSIFIED 
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All, 




















Based on the Program’s agreed upon POA&M, | grant the ACES system (asset ,a year ATO 
w/POA&M. This approval granted today, 

Working this approval in email (outside of Xacta) has been pre-coordinated with the SCA, DCA, DAO Rep, and 
DAO (who is on vacation). It is still a requirement for this approval to be completed in Xacta. 

Any questions, please contact me meal 












































From: 

Sent: Tuesday. July 05. 2016 12:37 PM 
To: 

Ce: 

Subject: FW: Approved - ACES POAM --- UNCLASSIFIED 











Approved for Release: 2018/07/19 C05112841 


Approved for Release: 2018/07/19 C05112841 


aa RR | nese ee area eae 

















From: 

Sent: ‘49 AM 

To: 

Ce: 

Subject: FW: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services 


(ACES), | — UNCLASSIFIED/Fede— 


Classification: UNCLASSIFIED//eve— 














For your action. I'll get the findings from VIAB. 


Vir 

















From: 
Sent: Tuesday, September 27, 2016 11:48 AM 
To: 

ce: 

Subject: RE: Extension Request for IATT (Operational) for Advaced Collaboration Enterprise Services (ACES) - 
UNCLASSIFIED//eQUQ— 




















Classification: UNCLASSIFIED/ eue-— 


OK, 
ll incorporate the latest findings from VIAB into the recommendation and pass through you both before sending it up. 


V/r 
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From: 

Sent: - Friday, September 23, 2016 1:39 PM 

To: 

Ce: 

Subject: FW: 21-SEPT-2016 SETR on the ACES assessment — 
Attachments: Sept-21-2016-SETR.docx 


Classification: -SBECREP//?kK//REE—PO-USA,_PVEY— 


Classified By: | 
Derived From: INCG dated 20120213 
Declassify On: 25X1, 20661231 
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Gentlemen, 








We completed the SED SETR this week...assessment from below...great news as 
we work toward “normalizing” this capability over the longer-term...as we deploy this needed capability across 


























in the short-term. 








Next Step: MAEC 


Best, 


























From: 
Sent: Friday, September 23. 2016 1:32 PM 
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Subject: 21-SEPT-2016 SETR on the 





ACES assessment ——SEGREFFAG/REL-FO-USA-FYET— 








Classification: -SRCRET//PR/7RED-TO-USA, —PVET— 











Classified By: 
Derived From: INCG dated 20120213 
Declassify On: 25X1, 20661231 
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Please post the attached notes and the briefings to the NRO SETR web site for leaders and attendees to access. 


SUBJ: (U) Major discussion points/notes from 21-SEPT-2016 SETR. 











Topic #1: (U) process triage assessment/recommendations for; “Mission Opportunity 





2016-003: Advanced Collaboration Enterprise Services” 


(U) SUMMARY/OVERVIEW Topic -1: 











ACES) 











(b)(3) 
(b)(3) 


(b)(3) 


(b)(3) 








ASFAGREEF (U) Comments/Discussion: 
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(b)(1) 
(b)(3) 








(U) RECOMMENDATION Topic-1: 














Regards; 
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From: | 


























Sent: Friday, December 18.2015 12:09 PM. 

To: 

Ge: 

Subject: > IMPORTANT: ACES - SRT - Next Step --- UNCLASSIFIED 











Classification: UNCLASSIFIED 


| pne]_| 


Request your earliest opportunity to meet with ito discuss ACES | _referenced below). Hopefully 
during this meeting we will concur on a finalized network diagram including detailed connections and an equipment 
list. We are hoping to reach a decision on any cross domain issues that stem from ongoing concerns raised by multiple 


stakeholders. 


Thank you, 
































ubject: IMPORTANT: ACES - SRT - Next Step --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Thanks for the discussion today...here’s what we agreed to do... 


1) Schedule a meeting ASAP with DAO, _| ACES Engineer(s) and diagram the exact ACES capability (server room, 

| being deployed O/A 29 Jan 16. Someone from DAO will do the actual diagramming so 
that it is done in a way that makes sense to ail internal NRO stakeholders. ACES Engineers will be there to 
support.| _will be there to ask questions/receive answers. 

2) Once diagramming is complete, DAO (or whomever you designate) will convert it into an appropriate format 
(e.g., visio, photo, etc.) 
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Please provide me a couple of dates over the next two weeks that work for DAO/ so that | can coordinate that with 
the ACES team and get it on the calendar. Let’s be sure to invite from MOD and anyone else that would benefit 
from attending (e.g., (ees etc.). 





Please communicate directly with and in all communications as | will be out of the office 
beginning 23 Dec. 

















Best, 
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From 

Sent: _Thursday. December 17. 2015 1:48 PM 

To: 

Ge: r 

Subject: FW: IMPORTANT: Xacta Project| ——_‘(/ ACES (Advanced Collaboration Enterprise 


Services) Installation -- UNCLASSIFIED 


Classification: UNCLASSIFIED 
























































You were left off the attached. is really pushing an for 
ACES (Advanced Collaboration Enterprise Services) . Director Sapp”. | would 
recommend a meeting with DAO (?), and prior to a meeting with 



































so you can ensure everyone is on the same page. 




















For the meeting is calling for below, | think it’s reached a point that you need to bring the big guns 
or into the picture!!! 






































From| 
Sent: Thursdav. December 17. 2015 11:17 AM 




















Subject: RE: IMPORTANT: ACES Installation --- UNCLASSIFIED 


Classification: UNCLASSIFIED 








Hi ...Just following up... Can we meet tomorrow (before 1500)? Or, worst case next Monday or Tuesday 
morning? 








| need to give the requisite ACES team members a heads up too (that will need to be at the meeting). 
Thank you. 


Best, 
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From: 
¢ r15 2015 11-17 4M 














Subject: IMPORTANT: ACES Installation --- UNCLASSIFIED 


Classification: UNCLASSIFIED 





















































Thank you for your time and assistance on the ACES installation. Director Sapp’s Operations . 
is moving through the NRO SRT process with a projected installation approval in and the 
O/A 29 Jan 15. 











Between now and then, we need to prepare for the install which will be completed by and the ACES Team. Here 
are key details regarding ACES install: ; 























I'd like to get the ACES Team and team together ASAP to discuss this. Can we meet this week or on Monday or 
Tuesday (at the very latest) of next week? 





Thank you. 


Best, 























Bini. 
Sent: Tuesday, December 15. 2015 10:06 AM 
To: 
Subject: --- UNCLASSIFIED 
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Classification: UNCLASSIFIED 





From: 
Sent: Thurs 7:12 PM 














Subject: RE: Revised schedule for ACES install in MOD/NROC --- UNCLASSIFIED 


Classification: UNCLASSIFIED 
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| appreciate you flagging this for our attention. In addition to DD/MS&O’s note to you today, | wanted to let you know 
we are looking at this and will work to improve schedule on this high priority system. 


What | found was the project initiated in roughly July with discussions of the basic needs. There were some problems 











noted early on to include Security approval for the displays. Nonetheless, we provided a ROM on 17 Sentemher and 
funding wa i 























| will be tdy much of next week so either or myself will get back to you or on 
schedule. 








V/R, 

















From: 
Sent: Thursday, December 10, 2015 11:28 AM 














Tor ACES install in MOD/NROC --- UNCLASSIFIED 
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| need your help with an install project in the NROC. We have requested a set of fitment changes ( 
to the NROC collaboration spaces and ou 
(called ACES) we are scheduled to install in late January. Our project POC, has 
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been in routine communication with your, _|team concerning timelines but the current facility schedule dates 
(below) do not match up with our planned technology instail plan. ACES is a high priority project for us and the 
timelines required extensive coordination with internal & external partners including the Headquarters Air Staff / A2 
who is lead for ACES. | know your teams are extremely busy with a multitude of projects across Westfield, but | would 
appreciate any assistance you can provide to increase priority of this project since it has direct impact to our joint 
collaboration mission in MOD. 





If you need any further detail or have questions, please contact me or Thank you for your 


consideration. 














v/r, 

Classification: UNCLASSIFIED 
Classification: UNCLASSIFIED 
Classification: UNCLASSIFIED _ 
Classification: UNCLASSIFIED 
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Sent: 2N15 3:OR DAA 

To: 

Ce: 

Subject: ANT: AGES Update - New RMF A&A Effort / Advanced Collaboration Enterprise 


Services (ACES) -- UNCLASSIFIED 


Classification: UNCLASSIFIED 











i would like to brief you on the latest advanced effort coming out of NROC [MOD] called ACES Advanced Collaboration 
Enterprise Services (ACES). 











1. This MOD asset is new and non-operational. Xacta Project 
2. They gave the 1* initial brief to most of the stakeholders at the MOD ERB on 9 Sept. (and I 
attended. 
3. Description: 
a. (U//FOUOYACES consists primarily of a server and video switcher that allows analysts the ability to 
change the presentation view by manipulating pixel space on the monitor. ACES eliminates the need 
for multiple monitors to view multiple screens of data. MOD's ACES installation requires 




















RMF Steps 1 & 2 have been closed in Xacta. 

An IATT Approval Task is currently sitting in the SCAs queue for 1/5. 

There is an ACES Demo scheduled for 5 Oct 2015 from 12-1400 at 1401 Wilson Blvd, Level B, Arlington, VA 
has asked| to facilitate a pre-brief prior to demo to respond to any 

questions we may have. 





NOW S 











So I’m just letting you know that will have representation from some of the DCAs. [sand | will both 
be there. | have forwarded you the calendar invite. See additional comments below. 








Please feel free to contact either, lor me if you have any additional questions or concerns. 


VR, 
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12:41 PM 


I am going into surgery on Wednesday and will be out several weeks. THIS DEM nnot wait for me...so, please 
coordinate and send me an email at or call me a this week with the date/time so I 
can make it hapen 























From: 
Sent: Monday. Sentemhber 28. 7015 4°13 AM 




















“SUDJECU: KE! ACES Demo and Intro --- UNCLASSIFIED//Feve— 


Classification: UNCLASSIFIED//rete— 











Hi 








I think it would be helpful if the ISSM for ACES also was there to help facilitate the discussion and 
answer any upfront questions prior to the demo. 


|] can you please get with 


Thank you! 

















Best, 




















From: 
2 26 2015 0-42 AM 











Subject: RE: ACES Demo and Intro --- UNCLASSIFIED//F6eve— 


Classification: UNCLASSIFIED/ ARQUO 


Hi 


Can you please give = and myself an overview of your visit and what to expect with the ACES Demo and 
Intro? Thanks. 
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Subject: RE: ACES Demo and Intro --- UNCLASSIFIED/#Feve- 


Classification: UNCLASSIFIED/ frouco— 











Hi 


lam also Ccing =Sss| (DAD Rep)... 


Hopefully gave you a summary of his visit to the ACES Lab in Arlington last week. 
and we definitely want all relevant stakeholders to be ACES “smart” as we maneuver 


through the NRO SRT process to get it accredited and authorized. 























We are holding another ACES demo for other NRO leadership on Monday, 5 Oct, from 1200-1400. 





it would be great if you can attend...you are cordially invited! ..you are reinvited as well as your leadership...the 
DAO). 


Please let me know this week if you can make this demo. Thank you. 


Best, 




















From: 








Sent: Monday, September 28, 2015 12:14 PM 











Subject: IMPORTANT: ACES Update --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Advanced Collaboration Enterprise Services (ACES) 
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Creating a Common Operating Environment (COE) 


This is a bi-weekly status update on ACES for all relevant Stakeholders. Highlights/Changes in Reel 





jm 
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Best, 
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From: | 




















Sent: “inursday, January 14. 2016 7:48 Ph 
To: 
Subject: IMPORTANT: ACES Update -- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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From: | 

Sent: luesday, December 15, 2015 12:12 PM 

To: 

Subject: TMPORTANT: ACES Updaie --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Advanced Collaboration Enterprise Services (ACES) 
Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a bi-weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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From: | 
Sent: “Monday. November 30 2015 0-45 AA 

To: 

Subject: IMPORTANT: ACES Update — UNCLASSIFIED 


Classification: UNCLASSIFIED 


Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) 


This is a bi-weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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From: E | 
Sent: riday, November 06, 2015 11:58 AM. 

To: 

Subject: : ate --- 
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Advanced Collaboration Enterprise Services (ACES) 
Creating a Common Operating Environment (COE) 


This is a bi-weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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From: | 





























Sent: —Thursdav. February 04 2016 12-22 PAA 
To: 
Subject: IMPORTANT: ACES Update —- UNCLASSIFIED 


Classification: UNCLASSIFIED 





Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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To: 














Subject: —TIMPURTANT: Weekly ACES Program Update—- UNCLASSIFIED --- UNCLASSIFIED 


Classification: UNCLASSIFIED 


Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for NRO enterprise operations 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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[erence 


From: 


il a 06.2016 3:07 PM 
0: 
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To: 











Subject: IMPORTANT: Weekly ACES Update --- UNCLASSIFIED 


Classification: UNCLASSIFIED 
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Advanced Collaboration Enterprise Services {ACES) 
Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Best, 
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From: 


Sent: ae, June 10. 2016 2°30 PM 
To: 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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To: 
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Subject: Pa Weekly ACES Update --- UNCLASSIFIED 


Classification: UNCLASSIFIED 








Advanced Collaboration Enterprise Services (ACES) 
Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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From: 
Sent: Friday, May 20, 2016 11:43 AM 
To: 
| 














Subject: IMPORTANT: Weekly ACES Update -- UNCLASSIFIED, 
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Approved for Release: 2018/07/19 C05112841 


Approved for Release: 2018/07/19 C05112841 


Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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From: eu 
Sent: onday. Mav 02. 2016 1:40 PM 
To: 
Subject: TWIPORTANT: Weekly ACES Update --- UNCLASSIFIED 
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Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Chaneges in Red. 
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From: | | 























Sent: Tuesday, April 19, 2016 11:04 AM 
To: 
Subject: IWIFUR TANT. WEEK ACES Update —- UNCLASSIFIED 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 
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This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red 
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Sent: fidav_Annl 01 2016 10-02 AM 

To: 

Subject: IMPORTANT: Weekly ACES Update —- UNCLASSIFIED 
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Advanced Collaboration Enterprise Services (ACES) 
Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 











Approved for Release: 2018/07/19 C05112841 


Approved for Release: 2018/07/19 C05112841 











Approved for Release: 2018/07/19 C05112841 








Approved for Release: 2018/07/19 C05112841 














Classification: UNCLASSIFIED 


Approved for Release: 2018/07/19 C05112841 


Approved for Release: 2018/07/19 C05112841 


eee eee re es See ene ee 











From: | | 




















Sent: Tuesday, March 08. 2016 12:34 Pi4 
To: 
Subject: WIE URTAINT. VWWeeKly ACES Update --- UNCLASSIFIED 


Classification: UNCLASSIFIED 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Sent: Monday, Februarv 29. 2016 2:08 PM 

To: 

Subject: IMPORTANT: Weekly ACES Update --- UNCLASSIFIED 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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Sent: Monday, February 22. 2016 11:55 AM 
To: 
Subject: IWIFUORTANT: WeeKly ACES Update -- UNCLASSIFIED 
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Advanced Collaboration Enterprise Services (ACES) 


Creating a Common Operating Environment (COE) for MOD Collaboration Enterprise 


This is a weekly status update on ACES for all relevant stakeholders. Highlights/Changes in Red. 
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